limbenjamin
  • Member for 7 years, 5 months
  • Last seen more than a month ago
Is SSL dying? Should I buy SSL certificates for my sites any more?
Accepted answer
89 votes

All except the third link refer to SSLv3 (version 3) which is affected by the poodle vulnerability. You should be using the TLS protocol which is the successor of SSL and not affected. You should ...

View answer
Why would security cover things like natural disasters?
50 votes

CISSP is an information security certification not a computer security certification. Information security is about the protecting the confidentiality, integrity, availabity of information in ...

View answer
Is it possible to "read" secure (using SSL or TLS) messages if you know the message?
Accepted answer
42 votes

No, SSL uses a symmetric key so an attacker is unable to decrypt the message he has just captured. However, SSL is vulnerable to a traffic analysis attack. E.g. If you have 2 messages of very ...

View answer
Why doesn't DNS spoofing work against HTTPS sites?
Accepted answer
31 votes

Assume you managed to poison the DNS cache for securesite.com with an IP that you control. Now, when the client visits https://securesite.com, it will resolve to your IP address. As part of the SSL ...

View answer
Is it unsafe to keep multiple versions of a KeePass database?
Accepted answer
18 votes

Let us assume that the attacker knows that the passphrase for all the database files are the same. What you have in mind is a two time pad attack, when we have multiple ciphertexts encrypted with the ...

View answer
Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?
Accepted answer
13 votes

Does the GET request for this cross-site request pass on the URL for the encrypted page I am visiting to the unencrypted ysite.com's server No. ysite.com will not know the URL for the page you are ...

View answer
What is a salami attack?
Accepted answer
9 votes

Nope, I don't think @munkeyoto has got the right idea. The following passage is from Bruce Schneier's Secret And Lies. There’s the so-called salami attack of stealing the fractions of pennies, ...

View answer
Best practices to copy private keys to mobile devices
Accepted answer
8 votes

You might want to try using a QR code to copy the key over. Generate the QR code on the laptop and scan it using your phone's camera. Obviously, dont use an online service to generate it, linux has a ...

View answer
How dangerous is it to reveal your date of birth, and why?
5 votes

With the name, birthday and address alone, an attacker could case your mailbox to find out which bank you have an account with. On your birthday, he could mail you a letter with that bank's letterhead ...

View answer
Can bankers' rounding be exploited to maliciously increase balances?
5 votes

A lot of checks go into critical functions such as transaction processing. Tests are run to ensure compliance to ACID (atomicity, consistency, isolation, durability) properties. Such code also goes ...

View answer
Is my ssh server safe because I use DenyHosts and don't allow root access?
5 votes

Security is a relative concept. I cannot say if a certain configuration is safe because there is always a safer practice. As you have mentioned, using a public/private key pair is more secure but you ...

View answer
How to protect a Wifi network from Microsoft WiFi Sense
4 votes

Just to add on, _optout_ can be added anywhere in the SSID not necessarily at the end. However, Google's _nomap has to be placed at the end. Yes, 802.11x will networks will not be shared through ...

View answer
Shielding electromagnetic wave
4 votes

Use a faraday cage. I have tried it before and managed to completing shield it such that it is unable to get any GSM or wifi signal. http://en.wikipedia.org/wiki/Faraday_cage A link on building ...

View answer
Keepass - Needle in a stack of needles
3 votes

What you are trying to do is to add an additional "security by obscurity" layer on top of the normal authentication layer which is the "security by design" layer. Yes, it will increase the amount of ...

View answer
Is there a civilian friendly indicator of stored password safety?
3 votes

Financial cost is also not a good metric. Moore's law can be used to derive that chip performance would double every 18 months. This results in greater computational power at the same price, hence it ...

View answer
What is the point in a password manager?
3 votes

A password manager allows you to set extremely complicated passwords that are unique for every site. If left to a human brain, we would most likely reuse or use a variation of similar passwords since ...

View answer
Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?
Accepted answer
3 votes

Principle of defence in depth - You will want to put in place additional layers of protection to protect your data. For your case, if an attacker manages to brute force your SSH password or manage ...

View answer
MITM on program with no proxy settings
Accepted answer
3 votes

Wireshark should be able to do it. However, the process is not as straightforward as you would have to scan the memory for the master secret. Here is a tutorial on how to decrypt SSL without access ...

View answer
Using Linux iptables to implement a stateless, packet filtering firewall
3 votes

For a stateless firewall, you can either accept or drop a packet based on its protocol, port number and origin ip address. For example, the rule below accepts all TCP packets from the 192.168.1.x ...

View answer
How to securely store sensitive data on mobile application?
3 votes

For android phones, there is a credential storage that allows you to store keys. It runs as a system daemon and uses AES to encrypt the keys. The keys are tied to the UID of the app that created it so ...

View answer
Website says my new password can't be used because it is the same as an old one
2 votes

What are the risks of storing (in hashes I guess) all the old passwords? The risks are very low, since the old passwords will not allow access to the account. Why would a company chose to not ...

View answer
What exactly does "Nation-State" code look like?
2 votes

Nation State attacks such as Stuxnet and the current Juniper attack target equipment which is not easily obtainable. Stuxnet targeted a SCADA logic controller while the Juniper attack targeted a high ...

View answer
What are the risks of file server access over wireless?
2 votes

It is difficult for someone to tell you if a particular resource is adequately protected as it depends on the value of the files stored on the server as well as many other factors. I am assuming that ...

View answer
If your company/university requires you to install root certificates what protects you from man in the middle attacks?
2 votes

In this case, cert 1 is known as the root certificate. You download it and install it from the university's website. The server certificate is cert 2, which is what the university's website presents ...

View answer
How to block spammers from using my public email api
2 votes

This is commonly known as a replay attack, when the attacker repeatedly transmits a legitimate message using a script. In this case, there are minor modifications to the message since the spammers ...

View answer
Smart Card for RSA private key for SSL?
Accepted answer
2 votes

I've never seen configuration in Apache or nginx which would seem to indicate support for anything other than file-based SSL private keys. You are using the Yubikey as a Hardware Security Module (...

View answer
Is secondary password (e.g.: pin) necessary?
2 votes

I believe what you are referring to is a one-time password (OTP). The 4 or 6 digit code may be sent via SMS or is displayed on a physical token device and is unique for every login. Does an ...

View answer
Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better?
2 votes

The additional overhead caused by the encrypting your payload is almost zero since CPUs today can encrypt at speeds of up to hundreds of MB/s. The only noticable delay is during connection setup, as ...

View answer
End user security awareness measurement
2 votes

With awareness, what we seek to achieve is a basic understanding of threats and responses. It differs from training and education which pushes for more detailed understanding and knowing the rationale ...

View answer
The effect of hidden or spoofed service banners on vulnerability scanners
2 votes

This sounds very much like security by obscurity to me. You are trying to hide the vulnerability from automated scanners. While such a measure might throw off simple scans, it does not actually ...

View answer